<!DOCTYPE html>
<html lang="en" country="us">
<head>

<style>.async-hide {
            opacity: 0 !important
        } </style>
<script data-cfasync="false">if (!window.location.hostname.match(/marketodesigner/i)) {
            (function (a, s, y, n, c, h, i, d, e) {
                s.className += ' ' + y;
                h.start = 1 * new Date;
                h.end = i = function () {
                    s.className = s.className.replace(RegExp(' ?' + y), '')
                };
                (a[n] = a[n] || []).hide = h;
                setTimeout(function () {
                    i();
                    h.end = null
                }, c);
                h.timeout = c;
            })(window, document.documentElement, 'async-hide', 'dataLayer', 1900,
                {'GTM-N8HXDD2': true})
        }</script>
<script data-cfasync="false" async src="https://www.googleoptimize.com/optimize.js?id=GTM-N8HXDD2" onerror="dataLayer.hide.end && dataLayer.hide.end()"></script>

<script data-cfasync="false">(function (w, d, s, l, i) {
            w[l] = w[l] || [];
            w[l].push({
                'gtm.start':
                    new Date().getTime(), event: 'gtm.js'
            });
            var f = d.getElementsByTagName(s)[0],
                j = d.createElement(s), dl = l != 'dataLayer' ? '&l=' + l : '';
            j.async = true;
            j.src =
                'https://www.googletagmanager.com/gtm.js?id=' + i + dl;
            f.parentNode.insertBefore(j, f);
        })(window, document, 'script', 'dataLayer', 'GTM-5V5LPNC');</script>

<script type="6f622b5d650afce2763d7d48-text/javascript" src="https://cdn.cookielaw.org/consent/bee15b7c-b632-450e-9003-9c8b60b3b978/OtAutoBlock.js"></script>
<script src="https://cdn.cookielaw.org/scripttemplates/otSDKStub.js" data-document-language="true" type="6f622b5d650afce2763d7d48-text/javascript" charset="UTF-8" data-domain-script=bee15b7c-b632-450e-9003-9c8b60b3b978></script>
<script type="6f622b5d650afce2763d7d48-text/javascript">
    function OptanonWrapper() { }
</script>
<meta charset="UTF-8">
<meta name="HandheldFriendly" content="True">
<meta name="MobileOptimized" content="320">
<meta name="viewport" content="width=device-width, initial-scale=1">
<meta name="apple-mobile-web-app-capable" content="yes">
<meta http-equiv="cleartype" content="on">
<meta name='robots' content='index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1' />

<title>How to Hunt for DecisiveArchitect and Its JustForFun Implant | CrowdStrike</title>
<meta name="description" content="CrowdStrike outlines the best methods to hunt for the JustForFun implant used by DecisiveArchitect to target global telecommunications companies." />
<link rel="canonical" href="https://www.crowdstrike.com/blog/how-to-hunt-for-decisivearchitect-and-justforfun-implant/" />
<meta property="og:locale" content="en_US" />
<meta property="og:type" content="article" />
<meta property="og:title" content="How to Hunt for DecisiveArchitect and Its JustForFun Implant | CrowdStrike" />
<meta property="og:description" content="CrowdStrike outlines the best methods to hunt for the JustForFun implant used by DecisiveArchitect to target global telecommunications companies." />
<meta property="og:url" content="https://www.crowdstrike.com/blog/how-to-hunt-for-decisivearchitect-and-justforfun-implant/" />
<meta property="og:site_name" content="crowdstrike.com" />
<meta property="article:publisher" content="https://www.facebook.com/CrowdStrike/" />
<meta property="article:published_time" content="2022-05-25T05:45:46+00:00" />
<meta property="article:modified_time" content="2022-05-25T09:06:17+00:00" />
<meta property="og:image" content="https://www.crowdstrike.com/wp-content/uploads/2022/05/0522_10_Hunting-Global-Telecomms-Threat_DecisiveArchitect_JustForFun_Blog_1060x698.jpeg" />
<meta property="og:image:width" content="1060" />
<meta property="og:image:height" content="698" />
<meta property="og:image:type" content="image/jpeg" />
<meta name="twitter:card" content="summary_large_image" />
<meta name="twitter:creator" content="@CrowdStrike" />
<meta name="twitter:site" content="@CrowdStrike" />
<meta name="twitter:label1" content="Written by" />
<meta name="twitter:data1" content="Jamie Harries" />
<meta name="twitter:label2" content="Est. reading time" />
<meta name="twitter:data2" content="9 minutes" />
<script type="application/ld+json" class="yoast-schema-graph">{"@context":"https://schema.org","@graph":[{"@type":"WebSite","@id":"https://www.crowdstrike.com/#website","url":"https://www.crowdstrike.com/","name":"crowdstrike.com","description":"Next-Generation Endpoint Protection","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://www.crowdstrike.com/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"ImageObject","@id":"https://www.crowdstrike.com/blog/how-to-hunt-for-decisivearchitect-and-justforfun-implant/#primaryimage","inLanguage":"en-US","url":"https://www.crowdstrike.com/wp-content/uploads/2022/05/0522_10_Hunting-Global-Telecomms-Threat_DecisiveArchitect_JustForFun_Blog_1060x698.jpeg","contentUrl":"https://www.crowdstrike.com/wp-content/uploads/2022/05/0522_10_Hunting-Global-Telecomms-Threat_DecisiveArchitect_JustForFun_Blog_1060x698.jpeg","width":1060,"height":698},{"@type":"WebPage","@id":"https://www.crowdstrike.com/blog/how-to-hunt-for-decisivearchitect-and-justforfun-implant/#webpage","url":"https://www.crowdstrike.com/blog/how-to-hunt-for-decisivearchitect-and-justforfun-implant/","name":"How to Hunt for DecisiveArchitect and Its JustForFun Implant | CrowdStrike","isPartOf":{"@id":"https://www.crowdstrike.com/#website"},"primaryImageOfPage":{"@id":"https://www.crowdstrike.com/blog/how-to-hunt-for-decisivearchitect-and-justforfun-implant/#primaryimage"},"datePublished":"2022-05-25T05:45:46+00:00","dateModified":"2022-05-25T09:06:17+00:00","author":{"@id":"https://www.crowdstrike.com/#/schema/person/4fa2aeebf8902a8c3c2ed5ea398c0be9"},"description":"CrowdStrike outlines the best methods to hunt for the JustForFun implant used by DecisiveArchitect to target global telecommunications companies.","breadcrumb":{"@id":"https://www.crowdstrike.com/blog/how-to-hunt-for-decisivearchitect-and-justforfun-implant/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https://www.crowdstrike.com/blog/how-to-hunt-for-decisivearchitect-and-justforfun-implant/"]}]},{"@type":"BreadcrumbList","@id":"https://www.crowdstrike.com/blog/how-to-hunt-for-decisivearchitect-and-justforfun-implant/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Hunting a Global Telecommunications Threat: DecisiveArchitect and Its Custom Implant JustForFun"}]},{"@type":"Person","@id":"https://www.crowdstrike.com/#/schema/person/4fa2aeebf8902a8c3c2ed5ea398c0be9","name":"Jamie Harries","image":{"@type":"ImageObject","@id":"https://www.crowdstrike.com/#personlogo","inLanguage":"en-US","url":"http://1.gravatar.com/avatar/4af62f72540d3a342cfe9f5d13eedab1?s=96&d=mm&r=g","contentUrl":"http://1.gravatar.com/avatar/4af62f72540d3a342cfe9f5d13eedab1?s=96&d=mm&r=g","caption":"Jamie Harries"},"url":"https://www.crowdstrike.com/blog/author/jamie-harries/"}]}</script>

<link rel="preload" href="https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/header/megamenu-content.json" as="json"><link rel="preload" href="https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/header/top-nav.json" as="json"><link rel="preload" href="https://www.crowdstrike.com/wp-content/themes/main-theme/dist/data/blog/blog-nav.json" as="json"><style id='global-styles-inline-css' type='text/css'>
body{--wp--preset--color--black: #000000;--wp--preset--color--cyan-bluish-gray: #abb8c3;--wp--preset--color--white: #ffffff;--wp--preset--color--pale-pink: #f78da7;--wp--preset--color--vivid-red: #cf2e2e;--wp--preset--color--luminous-vivid-orange: #ff6900;--wp--preset--color--luminous-vivid-amber: #fcb900;--wp--preset--color--light-green-cyan: #7bdcb5;--wp--preset--color--vivid-green-cyan: #00d084;--wp--preset--color--pale-cyan-blue: #8ed1fc;--wp--preset--color--vivid-cyan-blue: #0693e3;--wp--preset--color--vivid-purple: #9b51e0;--wp--preset--gradient--vivid-cyan-blue-to-vivid-purple: linear-gradient(135deg,rgba(6,147,227,1) 0%,rgb(155,81,224) 100%);--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan: linear-gradient(135deg,rgb(122,220,180) 0%,rgb(0,208,130) 100%);--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange: linear-gradient(135deg,rgba(252,185,0,1) 0%,rgba(255,105,0,1) 100%);--wp--preset--gradient--luminous-vivid-orange-to-vivid-red: linear-gradient(135deg,rgba(255,105,0,1) 0%,rgb(207,46,46) 100%);--wp--preset--gradient--very-light-gray-to-cyan-bluish-gray: linear-gradient(135deg,rgb(238,238,238) 0%,rgb(169,184,195) 100%);--wp--preset--gradient--cool-to-warm-spectrum: linear-gradient(135deg,rgb(74,234,220) 0%,rgb(151,120,209) 20%,rgb(207,42,186) 40%,rgb(238,44,130) 60%,rgb(251,105,98) 80%,rgb(254,248,76) 100%);--wp--preset--gradient--blush-light-purple: linear-gradient(135deg,rgb(255,206,236) 0%,rgb(152,150,240) 100%);--wp--preset--gradient--blush-bordeaux: linear-gradient(135deg,rgb(254,205,165) 0%,rgb(254,45,45) 50%,rgb(107,0,62) 100%);--wp--preset--gradient--luminous-dusk: linear-gradient(135deg,rgb(255,203,112) 0%,rgb(199,81,192) 50%,rgb(65,88,208) 100%);--wp--preset--gradient--pale-ocean: linear-gradient(135deg,rgb(255,245,203) 0%,rgb(182,227,212) 50%,rgb(51,167,181) 100%);--wp--preset--gradient--electric-grass: linear-gradient(135deg,rgb(202,248,128) 0%,rgb(113,206,126) 100%);--wp--preset--gradient--midnight: linear-gradient(135deg,rgb(2,3,129) 0%,rgb(40,116,252) 100%);--wp--preset--duotone--dark-grayscale: url('#wp-duotone-dark-grayscale');--wp--preset--duotone--grayscale: url('#wp-duotone-grayscale');--wp--preset--duotone--purple-yellow: url('#wp-duotone-purple-yellow');--wp--preset--duotone--blue-red: url('#wp-duotone-blue-red');--wp--preset--duotone--midnight: url('#wp-duotone-midnight');--wp--preset--duotone--magenta-yellow: url('#wp-duotone-magenta-yellow');--wp--preset--duotone--purple-green: url('#wp-duotone-purple-green');--wp--preset--duotone--blue-orange: url('#wp-duotone-blue-orange');--wp--preset--font-size--small: 13px;--wp--preset--font-size--medium: 20px;--wp--preset--font-size--large: 36px;--wp--preset--font-size--x-large: 42px;}.has-black-color{color: var(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-color{color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-color{color: var(--wp--preset--color--white) !important;}.has-pale-pink-color{color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-color{color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-color{color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-color{color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-color{color: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-color{color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-color{color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-color{color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-color{color: var(--wp--preset--color--vivid-purple) !important;}.has-black-background-color{background-color: var(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-background-color{background-color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-background-color{background-color: var(--wp--preset--color--white) !important;}.has-pale-pink-background-color{background-color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-background-color{background-color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-background-color{background-color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-background-color{background-color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-background-color{background-color: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-background-color{background-color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-background-color{background-color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-background-color{background-color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-background-color{background-color: var(--wp--preset--color--vivid-purple) !important;}.has-black-border-color{border-color: var(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-border-color{border-color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-border-color{border-color: var(--wp--preset--color--white) !important;}.has-pale-pink-border-color{border-color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-border-color{border-color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-border-color{border-color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-border-color{border-color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-border-color{border-color: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-border-color{border-color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-border-color{border-color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-border-color{border-color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-border-color{border-color: var(--wp--preset--color--vivid-purple) !important;}.has-vivid-cyan-blue-to-vivid-purple-gradient-background{background: var(--wp--preset--gradient--vivid-cyan-blue-to-vivid-purple) !important;}.has-light-green-cyan-to-vivid-green-cyan-gradient-background{background: var(--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan) !important;}.has-luminous-vivid-amber-to-luminous-vivid-orange-gradient-background{background: var(--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange) !important;}.has-luminous-vivid-orange-to-vivid-red-gradient-background{background: var(--wp--preset--gradient--luminous-vivid-orange-to-vivid-red) !important;}.has-very-light-gray-to-cyan-bluish-gray-gradient-background{background: var(--wp--preset--gradient--very-light-gray-to-cyan-bluish-gray) !important;}.has-cool-to-warm-spectrum-gradient-background{background: var(--wp--preset--gradient--cool-to-warm-spectrum) !important;}.has-blush-light-purple-gradient-background{background: var(--wp--preset--gradient--blush-light-purple) !important;}.has-blush-bordeaux-gradient-background{background: var(--wp--preset--gradient--blush-bordeaux) !important;}.has-luminous-dusk-gradient-background{background: var(--wp--preset--gradient--luminous-dusk) !important;}.has-pale-ocean-gradient-background{background: var(--wp--preset--gradient--pale-ocean) !important;}.has-electric-grass-gradient-background{background: var(--wp--preset--gradient--electric-grass) !important;}.has-midnight-gradient-background{background: var(--wp--preset--gradient--midnight) !important;}.has-small-font-size{font-size: var(--wp--preset--font-size--small) !important;}.has-medium-font-size{font-size: var(--wp--preset--font-size--medium) !important;}.has-large-font-size{font-size: var(--wp--preset--font-size--large) !important;}.has-x-large-font-size{font-size: var(--wp--preset--font-size--x-large) !important;}
</style>
<link rel='stylesheet' id='single-post.min.css-css' href='https://www.crowdstrike.com/wp-content/themes/main-theme/dist/styles/pages/single-post.min.css?ver=1653412578' type='text/css' media='all' />
<link rel='stylesheet' id='theme-styles-css' href='https://www.crowdstrike.com/wp-content/themes/main-theme/dist/styles/theme-styles.min.css?ver=1653412578' type='text/css' media='screen' />
<link rel='stylesheet' id='tablepress-default-css' href='https://www.crowdstrike.com/wp-content/tablepress-combined.min.css?ver=4' type='text/css' media='all' />
<script type="6f622b5d650afce2763d7d48-text/javascript" src='https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/fetch-inject.js?ver=1653412578' id='fetch-inject-js'></script>
<script type="6f622b5d650afce2763d7d48-text/javascript" src='https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/components/blog-navigation.min.js?ver=1653412577' id='blog-navigation-js'></script>
<script type="6f622b5d650afce2763d7d48-text/javascript" src='https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/components/blog-categories.min.js?ver=1653412577' id='blog-categories-js'></script>
<script type="6f622b5d650afce2763d7d48-text/javascript" src='https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/components/blog-category-sidebar.min.js?ver=1653412577' id='blog-category-sidebar-js'></script>
<link rel='shortlink' href='https://www.crowdstrike.com/?p=121991' />
<link rel="icon" href="https://www.crowdstrike.com/wp-content/uploads/2018/09/favicon-96x96.png" sizes="32x32" />
<link rel="icon" href="https://www.crowdstrike.com/wp-content/uploads/2018/09/favicon-96x96.png" sizes="192x192" />
<link rel="apple-touch-icon" href="https://www.crowdstrike.com/wp-content/uploads/2018/09/favicon-96x96.png" />
<meta name="msapplication-TileImage" content="https://www.crowdstrike.com/wp-content/uploads/2018/09/favicon-96x96.png" />
</head>
<body class="post-template-default single single-post postid-121991 single-format-standard lang-en">

<noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-5V5LPNC&nojs=1"
height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>

<script type="application/ld+json">
    {
        "@context": "http://schema.org",
        "@type": "Organization",
        "name": "CrowdStrike",
        "url": "http://www.crowdstrike.com",
        "logo": "http://www.crowdstrike.com/wp-content/img/cs_logo.png",
        "sameAs": [
            "http://www.facebook.com/CrowdStrike/",
            "http://www.twitter.com/CrowdStrike/",
            "https://plus.google.com/101967380457820256808/",
            "http://www.linkedin.com/company/crowdstrike",
            "http://www.youtube.com/user/CrowdStrike"
        ]
    }
</script>
<div data-id="wistia_player_embed"></div>
<div id="modal-mask" class="modal_insert_location">
<div class="container">
<div class="row">
<div class="col-lg-12">
<div id="modal-inner-mask" class="modal_mask">
<div class="close_button"><i id="modal-close" class="fa fa-close"></i></div>
<div id="modal-insert" class="modal_content"></div>
</div>
</div>
</div>
</div>
</div><div id="blogNavInsertLocation"></div>
<div class="cs_page_container ">
<div class="search_modal">
<div class="cs_header_container search_modal__section centered">

<input type="text" id="addsearchfield" class="addsearch" disabled="disabled" placeholder="Search" />
<script type="6f622b5d650afce2763d7d48-text/javascript" async="async" src="https://addsearch.com/js/?key=7737a29b854de71521b1cd72c4118cfc"></script>
</div>
</div>
<header id="megaMenu" class="cs_main_menu 0">
<div id="headerPromobar"></div>
<nav class="header_top_menu">
<div class="cs_header_container centered">
<div id="megamenu_top_insert" class="menu_inner_section"></div>
</div>
</nav>
<nav class="header_bottom_menu">
<div class="mega_menu">
<div class="cs_header_container centered mega_menu__header">
<div class="header_logo">
<a href="/">
<svg width="173px" height="32px" viewBox="0 0 173 32" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
<g id="Homepage" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">
<g id="Home" transform="translate(-72.000000, -7240.000000)" fill="#FEFEFE">
<g id="Group-24" transform="translate(72.000000, 7240.000000)">
<g id="Group-7" transform="translate(13.000000, 3.526700)">
<path d="M14.5154,12.2448 L14.5154,11.9378 L11.9154,9.6998 L11.6124,9.6998 C10.8974,10.4898 9.7934,11.0818 8.5584,11.0818 C6.6304,11.0818 5.1134,9.6118 5.1134,7.5938 C5.1134,5.5758 6.6304,4.1058 8.5584,4.1058 C9.7934,4.1058 10.8974,4.6978 11.6124,5.4878 L11.9154,5.4878 L14.5154,3.2498 L14.5154,2.9428 C13.1504,1.2758 11.0064,0.2008 8.5794,0.2008 C4.1174,0.2008 0.7384,3.3598 0.7384,7.5938 C0.7384,7.7578 0.7754,7.9088 0.7864,8.0698 C2.6124,9.3118 4.2244,10.3058 5.6124,11.2158 C7.6134,12.4818 9.2284,13.6468 10.5584,14.7298 C12.2164,14.3108 13.5604,13.4018 14.5154,12.2448 M2.3674,12.1658 C3.4094,13.4458 4.8804,14.3638 6.6154,14.7558 C5.4434,14.0968 4.3084,13.4498 3.2514,12.7338 C2.9414,12.5418 2.6654,12.3558 2.3674,12.1658" id="Fill-1"></path>
<path d="M29.571,14.0437 L28.921,11.2357 L28.683,11.0817 C28.553,11.1477 28.445,11.2357 28.12,11.2357 C27.621,11.2357 27.318,10.7087 27.058,10.2927 C26.625,9.6337 26.278,9.2827 25.975,9.1297 C27.556,8.4277 28.618,7.1117 28.618,5.2247 C28.618,2.3067 26.625,0.4637 22.921,0.4637 L16.465,0.4637 L16.465,14.7237 L20.754,14.7237 L20.754,9.7217 L21.144,9.7217 C22.097,9.7217 23.311,11.7837 23.874,12.7057 C25.044,14.5707 25.975,14.9867 27.643,14.9867 C28.423,14.9867 29.073,14.7017 29.463,14.3507 L29.571,14.0437 Z M24.242,5.4657 C24.242,6.4097 23.549,6.8697 22.747,6.8697 L20.754,6.8697 L20.754,3.9737 L22.747,3.9737 C23.549,3.9737 24.242,4.5007 24.242,5.4657 L24.242,5.4657 Z" id="Fill-3"></path>
<path d="M46.1426,7.5939 C46.1426,3.3599 42.7636,0.2009 38.2796,0.2009 C33.7946,0.2009 30.4156,3.3599 30.4156,7.5939 C30.4156,11.8279 33.7946,14.9869 38.2796,14.9869 C42.7636,14.9869 46.1426,11.8059 46.1426,7.5939 M41.7666,7.5939 C41.7666,9.6339 40.2066,11.0819 38.2796,11.0819 C36.3516,11.0819 34.7916,9.6339 34.7916,7.5939 C34.7916,5.5539 36.3516,4.1059 38.2796,4.1059 C40.2066,4.1059 41.7666,5.5539 41.7666,7.5939" id="Fill-5"></path>
</g>
<polygon id="Fill-8" points="80.6103 3.9906 76.5163 3.9906 73.9813 11.8886 71.2953 3.9906 68.6963 3.9906 66.0313 11.8446 63.4973 3.9906 59.4023 3.9906 59.2073 4.3196 64.4503 18.2506 67.0493 18.2506 69.9953 10.4846 72.9633 18.2506 75.5633 18.2506 80.8053 4.3196"></polygon>
<path d="M96.5105,11.0987 C96.5105,6.8427 93.6725,3.9907 89.0585,3.9907 L82.4945,3.9907 L82.4945,18.2507 L89.0585,18.2507 C93.6725,18.2507 96.5105,15.3987 96.5105,11.0987 M92.1345,11.1207 C92.1345,13.4457 90.7695,14.7407 88.8855,14.7407 L86.7835,14.7407 L86.7835,7.5007 L88.8855,7.5007 C90.7695,7.5007 92.1345,8.7957 92.1345,11.1207" id="Fill-9"></path>
<polygon id="Fill-11" points="119.2316 7.5008 123.5206 7.5008 123.5206 3.9908 110.6536 3.9908 110.6536 7.5008 114.9426 7.5008 114.9426 18.2508 119.2316 18.2508"></polygon>
<path d="M137.233,8.7513 C137.233,5.8333 135.24,3.9903 131.536,3.9903 L125.08,3.9903 L125.08,18.2503 L129.37,18.2503 L129.37,13.2483 L130.388,13.2483 L133.052,18.2503 L137.32,18.2503 L137.515,17.9213 L134.655,12.6343 C136.193,11.9103 137.233,10.6163 137.233,8.7513 M132.857,8.9923 C132.857,9.9363 132.164,10.3963 131.362,10.3963 L129.37,10.3963 L129.37,7.5003 L131.362,7.5003 C132.164,7.5003 132.857,8.0273 132.857,8.9923" id="Fill-12"></path>
<polygon id="Fill-14" points="139.832 18.2507 144.121 18.2507 144.121 3.9907 139.832 3.9907"></polygon>
<polygon id="Fill-15" points="154.9957 10.3747 159.8477 4.3197 159.6527 3.9907 155.0827 3.9907 151.1177 9.0587 151.1177 3.9907 146.8287 3.9907 146.8287 18.2507 151.1177 18.2507 151.1177 13.8627 151.8977 12.9417 155.5377 18.2507 160.0217 18.2507 160.2167 17.9217"></polygon>
<polygon id="Fill-16" points="161.3862 3.9903 161.3862 18.2513 172.1732 18.2513 172.1732 14.7413 165.6742 14.7413 165.6742 12.7663 170.5702 12.7663 170.5702 9.4753 165.6742 9.4753 165.6742 7.5013 172.1092 7.5013 172.1092 3.9903"></polygon>
<g id="Group-23" transform="translate(0.000000, 0.526700)">
<path d="M103.7658,17.8933 C106.9078,17.8933 109.6348,16.3583 109.6348,13.3983 C109.6348,10.1723 106.8858,9.3383 104.4598,8.6363 C103.5058,8.3513 102.5298,8.0213 102.5298,7.3193 C102.5298,6.8143 103.0718,6.5073 103.8958,6.5073 C105.3048,6.5073 106.4958,7.3853 107.1018,7.9563 L107.4048,7.9563 L109.4188,5.5433 L109.4188,5.2363 C108.3578,4.0303 106.1928,3.1093 103.8088,3.1093 C100.4728,3.1093 98.1568,4.9073 98.1568,7.5173 C98.1568,10.3263 100.7108,11.5553 102.8768,12.1693 C104.2858,12.5643 105.2408,12.6303 105.2408,13.3983 C105.2408,13.9473 104.5678,14.2763 103.5268,14.2763 C102.2048,14.2763 100.6028,13.4203 99.8238,12.6523 L99.5208,12.6523 L97.5288,15.1533 L97.5288,15.4603 C98.8058,16.8853 101.1008,17.8933 103.7658,17.8933" id="Fill-17"></path>
<path d="M29.8197,30.9998 C28.7807,28.6218 26.6937,25.5708 18.5177,21.2138 C14.7477,19.1178 8.3067,15.8908 2.5137,9.7578 C3.0387,11.9718 5.7287,16.8368 17.2987,22.9118 C20.5027,24.6648 25.9207,26.3088 29.8197,30.9998" id="Fill-19"></path>
<path d="M29.298,26.9271 C28.312,24.1171 26.532,20.5191 18.091,15.1751 C13.98,12.4811 7.945,9.0981 0,0.4731 C0.568,2.7981 3.078,8.8441 15.73,16.6931 C19.886,19.5091 25.25,21.2461 29.298,26.9271" id="Fill-21"></path>
</g>
</g>
</g>
</g>
</svg> </a>
</div>
<div id="megaSearch" data-id="search" class="search_btn fa-solid fa-magnifying-glass"></div>
<div id="csMobileMenuBtn" class="mobile_menu_btn"><span></span></div>
<div class="mega_menu__content">
<ul id="megamenu_bottom_nav_insert" class="mega_menu__links"></ul>
<div id="megamenu_bottom_nav_content" class="mega_menu__body"></div>
</div>
</div>
</div>
</nav>
</header>
<div class="cs_page_content">
<div class="mobile_nav_section">
<div class="mobile_nav_content">
<div id="megamenu_mobile_main_nav" class="list_items_content"></div>
</div>
</div>
<div class="cs_main_section">
<main class="main">
<article>
<div class="container">
<div class="row">
<div class="col-12 col-lg-8">
<h1>Hunting a Global Telecommunications Threat: DecisiveArchitect and Its Custom Implant JustForFun</h1>
<div class="publish_info">
<p>May 25, 2022</p> <a href="https://www.crowdstrike.com/blog/author/jamie-harries/" title="Posts by Jamie Harries" rel="author">Jamie Harries</a> <a href="https://www.crowdstrike.com/blog/category/from-the-front-lines/" title="From The Front Lines">From The Front Lines</a> </div>
<div class="post_image"><img width="1060" height="698" src="https://www.crowdstrike.com/wp-content/uploads/2022/05/0522_10_Hunting-Global-Telecomms-Threat_DecisiveArchitect_JustForFun_Blog_1060x698.jpeg" class="attachment-post-thumbnail size-post-thumbnail wp-post-image" alt="" srcset="https://www.crowdstrike.com/wp-content/uploads/2022/05/0522_10_Hunting-Global-Telecomms-Threat_DecisiveArchitect_JustForFun_Blog_1060x698.jpeg 1060w, https://www.crowdstrike.com/wp-content/uploads/2022/05/0522_10_Hunting-Global-Telecomms-Threat_DecisiveArchitect_JustForFun_Blog_1060x698-300x198.jpeg 300w, https://www.crowdstrike.com/wp-content/uploads/2022/05/0522_10_Hunting-Global-Telecomms-Threat_DecisiveArchitect_JustForFun_Blog_1060x698-1024x674.jpeg 1024w, https://www.crowdstrike.com/wp-content/uploads/2022/05/0522_10_Hunting-Global-Telecomms-Threat_DecisiveArchitect_JustForFun_Blog_1060x698-768x506.jpeg 768w" sizes="(max-width: 1060px) 100vw, 1060px" /></div>
<div class="blog_content">
<p><span style="font-weight: 400;">The security landscape is constantly developing to provide easier ways to establish endpoint visibility across networks through the use of </span><a href="https://www.crowdstrike.com/cybersecurity-101/endpoint-security/endpoint-detection-and-response-edr/"><span style="font-weight: 400;">endpoint detection and response (EDR)</span></a><span style="font-weight: 400;"> utilities. However, certain challenges still remain, particularly as a result of many organizations&#8217; need for systems running legacy or proprietary operating systems, such as Solaris. If such systems are not adequately protected using other security controls or unless they can only be accessed by systems with appropriate endpoint-based detection/prevention capabilities, this can cause a gap in visibility for an organization that an adversary could abuse.</span></p>
<p><span style="font-weight: 400;">On multiple occasions dating back to 2019, the CrowdStrike Services Incident Response team, CrowdStrike Intelligence team and Falcon OverWatch&#x2122; team have encountered an adversary targeting global entities, in particular telecommunications companies, to obtain targeted personal user information — for example, call detail records (CDRs) or information relating to specific phone numbers. </span></p>
<p><span style="font-weight: 400;">Similar to the activity cluster reported as </span><a href="https://www.crowdstrike.com/blog/an-analysis-of-lightbasin-telecommunications-attacks/"><span style="font-weight: 400;">LightBasin</span></a><span style="font-weight: 400;">, this adversary primarily focuses on Linux and Solaris systems using a custom-built implant tracked by CrowdStrike Intelligence as JustForFun (also publicly known as BPFDoor). While this adversary does interact with Windows systems, mostly during the early stages of an intrusion, CrowdStrike has not yet identified any custom implants geared toward Windows systems. Instead, the adversary relies on publicly available tools, such as ldapdomaindump, or the post-exploitation framework Impacket, to target Windows systems from previously compromised Linux systems.</span></p>
<p><span style="font-weight: 400;">CrowdStrike Intelligence is currently tracking these intrusions under the DecisiveArchitect activity cluster (also publicly known as Red Menshen; however, this activity is not currently attributed by CrowdStrike to a specific country-nexus. While CrowdStrike has primarily observed the adversary targeting telecommunications companies, other isolated incidents targeting organizations such as logistics entities have also been observed.</span></p>
<p><span style="font-weight: 400;">DecisiveArchitect exhibits a high degree of operational security as part of their tactics to make it more difficult for defenders to identify and investigate their activity through the use of various defense evasion techniques. While other publicly available research highlights how the implant operates, this blog focuses on methods to hunt for this implant, or implants that may operate in a similar manner, while also highlighting techniques of interest across Solaris systems.</span></p>
<h2><span style="font-weight: 400;">Spoofed Command Lines</span></h2>
<p><span style="font-weight: 400;">DecisiveArchitect utilizes a custom implant tracked by CrowdStrike as JustForFun, which is typically persisted using SysVinit scripts. When executed, the implant overwrites the process command line within the process environment by randomly selecting a new command line from one of ten hard-coded options, listed in Figure 1.</span></p>
<pre><code>/sbin/udevd -d
/sbin/mingetty /dev/tty6
/usr/sbin/console-kit-daemon --no-daemon
hald-addon-acpi: listening on acpi kernel interface /proc/acpi/event
dbus-daemon --system
hald-runner
pickup -l -t fifo -u
avahi-daemon: chroot helper
/sbin/auditd -n
/usr/lib/systemd/systemd-journald</code></pre>
<p style="text-align: center;"><span style="font-weight: 400;">Figure 1. Hard-coded options for command-line spoofing in JustForFun</span></p>
<p><span style="font-weight: 400;">When DecisiveArchitect interacts with the implants to establish an interactive shell on a system, the </span><code><span style="font-weight: 400;">bash </span></code><span style="font-weight: 400;">process spawned by the implant process displays the following command line instead. This makes it appear as if the Postfix queue manager is executing as a way to hide itself from analysts and system administrators:</span></p>
<p><code><span style="font-weight: 400;">qmgr -l -t fifo -u</span></code></p>
<p><span style="font-weight: 400;">On Solaris systems, though the executable itself exhibits no mechanism for similar command-line spoofing, DecisiveArchitect achieves similar functionality through the use of </span><code><span style="font-weight: 400;">LD_PRELOAD</span></code><span style="font-weight: 400;">, such as the following example identified within a SysVinit script:</span></p>
<p><code><span style="font-weight: 400;">LD_PRELOAD=/lib/librbtinfo.so.1 /usr/lib/vtdaemon -c 16</span></code></p>
<p><span style="font-weight: 400;">When executed, the process only shows the command line </span><code><span style="font-weight: 400;">/usr/lib/vtdaemon -c 16</span></code><span style="font-weight: 400;">, where the actual JustForFun implant is the file </span><code><span style="font-weight: 400;">/lib/librbtinfo.so.1</span></code><span style="font-weight: 400;">.</span></p>
<p><span style="font-weight: 400;">As recently as April 2022, CrowdStrike observed further variations with regard to DecisiveArchitect&#8217;s tactics, techniques and procedures (TTPs), with the actor using the </span><code><span style="font-weight: 400;">LD_PRELOAD</span></code><span style="font-weight: 400;"> environment variable across Linux systems as well, loading the JustForFun implant, </span><code><span style="font-weight: 400;">/lib64/libcaac.so.1</span></code><span style="font-weight: 400;">, within the legitimate process </span><code><span style="font-weight: 400;">/sbin/agetty</span></code><span style="font-weight: 400;">. This highlights a deviation from the standard list of spoofed command lines in Figure 1, likely as part of a further effort to remain undetected and emphasizing the importance of behavioral-based hunting and detection methods.</span></p>
<p><span style="font-weight: 400;">The spoofed command line appears in commands such as </span><code><span style="font-weight: 400;">ps</span></code> <span style="font-weight: 400;">that may be used to investigate suspicious activity on the host. The spoofed command line makes it less likely that the process will be treated as suspicious.</span></p>
<h2><span style="font-weight: 400;">Solaris Privilege Escalation Vulnerability Exploitation</span></h2>
<p><span style="font-weight: 400;">DecisiveArchitect targets Solaris systems via publicly available exploit code for CVE-2019-3010, a vulnerability in </span><code><span style="font-weight: 400;">xscreensaver</span></code><span style="font-weight: 400;">. Binaries used to exploit this vulnerability have usually been observed within a few minutes of the JustForFun implant deployment. CVE-2019-3010 is a logic bug that utilizes the </span><code><span style="font-weight: 400;">LD_PRELOAD </span></code><span style="font-weight: 400;">technique to facilitate local privilege escalation to the root user on Solaris 11 systems. Proof-of-concept (POC) code is publicly available and was not modified by DecisiveArchitect.<sup>1</sup></span><span style="font-weight: 400;"> Table 1 lists two files observed across Solaris systems related to this privilege escalation activity.</span></p>
<table class="orange" width="624">
<tbody>
<tr class="top-row bg-orange">
<td><strong>File Path</strong></td>
<td><strong>Purpose</strong></td>
</tr>
<tr>
<td>/tmp/getuid.so</td>
<td>CVE-2019-3010 exploit binary</td>
</tr>
<tr>
<td>/usr/lib/secure/getuid.so</td>
<td>CVE-2019-3010 exploit binary or log file</td>
</tr>
</tbody>
</table>
<p style="text-align: center;"><span style="font-weight: 400;">Table 1. Solaris exploitation file details</span></p>
<h2><span style="font-weight: 400;">Persistence</span></h2>
<p><span style="font-weight: 400;">The way in which DecisiveArchitect achieves persistence across Linux systems involves the usage of SysVinit scripts (i.e., rc.d/init.d scripts). Instead of simply creating a new script that references the JustForFun implants, DecisiveArchitect uses a more operational security-conscious approach by modifying existing SysVinit scripts to reference a small script file, which then finally references the JustForFun implant. The following highlights an example, including the lines added to the legitimate SysVinit script </span><code><span style="font-weight: 400;">/etc/rc.d/init.d/pcscd</span></code><span style="font-weight: 400;"> and the script </span><code><span style="font-weight: 400;">/etc/sysconfig/pcscd</span></code><span style="font-weight: 400;"> referencing the JustForFun implant, </span><code><span style="font-weight: 400;">/etc/sysconfig/pcscd.conf</span></code><span style="font-weight: 400;">:</span></p>
<p><code><b>/etc/rc.d/init.d/pcscd:</b></code></p>
<ul>
<li><b>Line 41:</b> <code><span style="font-weight: 400;">if [ -f /etc/sysconfig/pcscd ] ; then</span></code></li>
<li><b>Line 42:</b> <span style="font-weight: 400;"> <code>/etc/sysconfig/pcscd</code></span></li>
</ul>
<p><code><b>/etc/sysconfig/pcscd:</b></code></p>
<pre><code># Source config
if [ -f /etc/sysconfig/pcscd.conf ] ; then
    /etc/sysconfig/pcscd.conf
fi</code></pre>
<p><span style="font-weight: 400;">With this method of nested persistence, if an analyst simply reviews a set of SysVinit scripts by themselves, identifying the malicious line associated with the JustForFun implant would likely prove difficult without subsequently reviewing all of the files referenced within the scripts. Additionally, as part of DecisiveArchitect’s continued commitment to operational security, the adversary modifies different legitimate SysVinit scripts across systems, and uses different file names/paths for the implant and associated persistence-related scripts, making it difficult to search across other systems for indicators identified through analysis of a single system.</span></p>
<h2><span style="font-weight: 400;">Detection and Hunting</span></h2>
<p><span style="font-weight: 400;">One of the best ways to detect or hunt for this activity is to utilize EDR technology across supported Linux systems, with machine learning capabilities to detect and prevent the malicious implants, and with hunting capabilities to identify anomalous usage of common Linux system administration utilities or processes running with spoofed command lines (such as the </span><code><span style="font-weight: 400;">bash</span></code><span style="font-weight: 400;"> process running with the command line showing the Postfix queue manager command line instead). Figures 2 and 3 highlight the CrowdStrike Falcon<sup>®</sup> platform’s machine learning capabilities and Falcon OverWatch detections associated with the JustForFun implant and JustForFun command-line tool.</span></p>
<p><em><b>Please note: The examples in the following scenario have CrowdStrike Falcon configured with DETECTIONS ONLY and PREVENTIONS off. A properly configured Falcon instance, as noted previously, would prevent the activity presented here.</b></em></p>
<div id="attachment_122000" style="width: 4391px" class="wp-caption alignnone"><a href="https://www.crowdstrike.com/wp-content/uploads/2022/05/Picture1-14.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-122000" loading="lazy" class="wp-image-122000 size-full" src="https://www.crowdstrike.com/wp-content/uploads/2022/05/Picture1-14.png" alt="" width="4381" height="1102" srcset="https://www.crowdstrike.com/wp-content/uploads/2022/05/Picture1-14.png 4381w, https://www.crowdstrike.com/wp-content/uploads/2022/05/Picture1-14-300x75.png 300w, https://www.crowdstrike.com/wp-content/uploads/2022/05/Picture1-14-1024x258.png 1024w, https://www.crowdstrike.com/wp-content/uploads/2022/05/Picture1-14-768x193.png 768w, https://www.crowdstrike.com/wp-content/uploads/2022/05/Picture1-14-1536x386.png 1536w, https://www.crowdstrike.com/wp-content/uploads/2022/05/Picture1-14-2048x515.png 2048w" sizes="(max-width: 4381px) 100vw, 4381px" /></a><p id="caption-attachment-122000" class="wp-caption-text">Figure 2. JustForFun implant detection (Click to enlarge)</p></div>
<div id="attachment_122003" style="width: 2205px" class="wp-caption alignnone"><a href="https://www.crowdstrike.com/wp-content/uploads/2022/05/Picture1-17.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-122003" loading="lazy" class="wp-image-122003 size-full" src="https://www.crowdstrike.com/wp-content/uploads/2022/05/Picture1-17.png" alt="" width="2195" height="1141" srcset="https://www.crowdstrike.com/wp-content/uploads/2022/05/Picture1-17.png 2195w, https://www.crowdstrike.com/wp-content/uploads/2022/05/Picture1-17-300x156.png 300w, https://www.crowdstrike.com/wp-content/uploads/2022/05/Picture1-17-1024x532.png 1024w, https://www.crowdstrike.com/wp-content/uploads/2022/05/Picture1-17-768x399.png 768w, https://www.crowdstrike.com/wp-content/uploads/2022/05/Picture1-17-1536x798.png 1536w, https://www.crowdstrike.com/wp-content/uploads/2022/05/Picture1-17-2048x1065.png 2048w" sizes="(max-width: 2195px) 100vw, 2195px" /></a><p id="caption-attachment-122003" class="wp-caption-text">Figure 3. JustForFun command-line tool detections (Click to enlarge)</p></div>
<p><span style="font-weight: 400;">But, even if an organization has a significant number of legacy or proprietary systems, already has the adversary burrowed into their network, or simply does not have EDR software deployed across Linux systems, all is not lost.</span></p>
<h2><span style="font-weight: 400;">Hunting for Traffic Signaling Implants</span></h2>
<p><span style="font-weight: 400;">Given the fact the JustForFun implant opens a raw socket in order to wait for the magic packet, the built-in Linux utility </span><code><span style="font-weight: 400;">lsof</span></code><span style="font-weight: 400;"> can be used to identify running processes with a raw socket open:</span></p>
<p><code><span style="font-weight: 400;">lsof -RPnl | grep SOCK_RAW | grep IP</span></code></p>
<p><span style="font-weight: 400;">Even though this command alone cannot solely determine whether the implant is present — as there are legitimate reasons for processes to have raw sockets open — analysts can highlight processes of interest for further investigation. Of particular importance is that DecisiveArchitect’s use of spoofed command lines means that the </span><code><span style="font-weight: 400;">lsof </span></code><span style="font-weight: 400;">command will report the spoofed command line, as opposed to the actual malicious file, which may make it difficult to determine whether the process is malicious or not through this alone. However, by running the </span><code><span style="font-weight: 400;">lsof </span></code><span style="font-weight: 400;">command against the process ID without any of the </span><code><span style="font-weight: 400;">grep</span></code> <span style="font-weight: 400;">filtering, an analyst can list any open files associated with that process, which should reveal the binary. An example of a true positive can be seen below, with the start of the line (i.e., the command line) displaying the start of one of the spoofed command lines listed in Figure 1. It should be noted that DecisiveArchitect can quite easily change these spoofed command lines, so analysts should be conscious of other processes beyond those listed:</span></p>
<p><code><span style="font-weight: 400;">dbus-daem 1215 0 root 3u pack 11912 0t0 IP type=SOCK_RAW</span></code></p>
<p><span style="font-weight: 400;">While the </span><code><span style="font-weight: 400;">lsof</span></code><span style="font-weight: 400;"> command is not part of a default Solaris installation, similar commands exist for obtaining additional details from processes:</span></p>
<pre><code>for _PIDno in /proc/*; do line=$(pfiles "${_PIDno}"); echo $_PIDno $line | grep bpf; done
for _PIDno in /proc/*; do line=$(pmap "${_PIDno}"); echo $_PIDno $line | grep libpcap; done
for _PIDno in /proc/*; do line=$(pldd "${_PIDno}"); echo $_PIDno $line | grep libpcap; done</code></pre>
<p><span style="font-weight: 400;">The three commands above loop through every process, with the first command looking for a string indicative of a process running with a packet filter, and the other two searching for processes with the </span><code><span style="font-weight: 400;">libpcap</span></code><span style="font-weight: 400;"> library loaded. As with the </span><code><span style="font-weight: 400;">lsof</span></code><span style="font-weight: 400;"> command, this alone cannot solely determine whether the implant is present, so an analyst would need to further investigate the specific process to confirm the presence of the implant. DecisiveArchitect’s capability to spoof command lines across Solaris systems also needs to be taken into account when investigating these processes.</span></p>
<p><span style="font-weight: 400;">When investigating any of these entries, one of the key questions to ask is whether the process in question has any reason to have a raw socket open, to be using a packet filter or to be utilizing the </span><code><span style="font-weight: 400;">libpcap</span></code><span style="font-weight: 400;"> library. One of the most common false positives relates to systems running processes such as </span><span style="font-weight: 400;"><code>tcpdump</code></span><span style="font-weight: 400;"> or other packet capture utilities.</span></p>
<p><span style="font-weight: 400;">While these hunting techniques provide a relatively simple method for identifying DecisiveArchitect activity based on activity observed across multiple intrusions, CrowdStrike expects that DecisiveArchitect will continue development of their implant across both Linux and Solaris platforms, while also improving their techniques regarding operational security of their intrusions to further hinder the ability of a defender to identify or investigate their activity, which might include identifying ways to combat these hunting techniques.</span></p>
<h2><span style="font-weight: 400;">Conclusion</span></h2>
<p><span style="font-weight: 400;">DecisiveArchitect’s operations present a clear and present threat to telecommunications companies, as well as other organizations such as logistics entities. This blog highlights important details about DecisiveArchitect’s implant, their abilities to operate on Solaris systems, and ways to hunt down the adversary’s implants to help organizations identify whether they have fallen victim to this campaign.</span></p>
<h3><span style="font-weight: 400;">Endnotes</span></h3>
<ol>
<li style="font-weight: 400;" aria-level="1"><span style="font-weight: 400;">https[:]//github[.]com/0xdea/exploits/blob/master/solaris/raptor_xscreensaver</span></li>
</ol>
<h2><span style="font-weight: 400;">Indicators of Compromise (IOCs)</span></h2>
<table class="orange">
<tbody>
<tr class="top-row bg-orange">
<td><strong>Indicator</strong></td>
<td><strong>Platform</strong></td>
<td><strong>Purpose</strong></td>
</tr>
<tr>
<td><code>/run/lock/kdumpflush<br />
/run/lock/kdumpcab<br />
/var/lock/kdumpcab<br />
/var/lock/kdumpcache<br />
/dev/shm/kdmtmpflush<br />
/dev/shm/kdevtmpfls<br />
/dev/shm/ff</code></td>
<td>Linux</td>
<td>JustForFun implant pathnames (temporary &#8211; running process)</td>
</tr>
<tr>
<td><code>/etc/avahi/avahi.conf<br />
/etc/cups/cups<br />
/etc/cups/cups.conf<br />
/etc/gofer/gofor.conf<br />
/etc/gss/gss.conf<br />
/etc/jvm/jvm.conf<br />
/etc/ntp/ntpd<br />
/etc/opt/opt.conf<br />
/etc/pm/pm.conf<br />
/etc/pulp/agent.conf<br />
/etc/ssl/ssl.conf<br />
/etc/sysconfig/kdumplog<br />
/etc/sysconfig/nfs.conf<br />
/etc/sysconfig/pcscd.conf<br />
/etc/xdg/xdg.conf<br />
/usr/java/jdk1.8.0_181-amd64/.java/init.d/jexecd<br />
/usr/local/mysql/bin/myisambug<br />
/lib64/libcaac.so.1</code></td>
<td>Linux</td>
<td>JustForFun implant pathnames (persistent &#8211; on disk)</td>
</tr>
<tr>
<td><code>/lib/librbtinfo.so.1<br />
/usr/lib/autofs/mountd<br />
/opt/VRTSvcs/bin/IP/online_Agent</code></td>
<td>Solaris</td>
<td>JustForFun implant pathnames</td>
</tr>
<tr>
<td><code>/run/lock/lvv<br />
/run/lock/lvm/lv<br />
/var/run/lvm/vm<br />
/dev/shm/sem</code></td>
<td>Linux</td>
<td>JustForFun CLI utility pathnames</td>
</tr>
<tr>
<td><code>/tmp/getuid.so<br />
/usr/lib/secure/getuid.so</code></td>
<td>Solaris</td>
<td>CVE-2019-3010 exploitation-related files (not unique to DecisiveArchitect)</td>
</tr>
<tr>
<td><code>/usr/local/bin/GetADUsers.py<br />
/usr/local/bin/GetNPUsers.py<br />
/usr/local/bin/GetUserSPNs.py<br />
/usr/local/bin/atexec.py<br />
/usr/local/bin/dcomexec.py<br />
/usr/local/bin/dpapi.py<br />
/usr/local/bin/esentutl.py<br />
/usr/local/bin/getArch.py<br />
/usr/local/bin/getPac.py<br />
/usr/local/bin/getST.py<br />
/usr/local/bin/getTGT.py<br />
/usr/local/bin/goldenPac.py<br />
/usr/local/bin/ifmap.py<br />
/usr/local/bin/karmaSMB.py<br />
/usr/local/bin/lookupsid.py<br />
/usr/local/bin/mimikatz.py<br />
/usr/local/bin/mqtt_check.py<br />
/usr/local/bin/mssqlclient.py<br />
/usr/local/bin/mssqlinstance.py<br />
/usr/local/bin/netview.py<br />
/usr/local/bin/nmapAnswerMachine.py<br />
/usr/local/bin/ntfs-read.py<br />
/usr/local/bin/ntlmrelayx.py<br />
/usr/local/bin/opdump.py<br />
/usr/local/bin/ping.py<br />
/usr/local/bin/ping6.py<br />
/usr/local/bin/psexec.py<br />
/usr/local/bin/raiseChild.py<br />
/usr/local/bin/rdp_check.py<br />
/usr/local/bin/reg.py<br />
/usr/local/bin/registry-read.py<br />
/usr/local/bin/rpcdump.py<br />
/usr/local/bin/sambaPipe.py<br />
/usr/local/bin/samrdump.py<br />
/usr/local/bin/secretsdump.py<br />
/usr/local/bin/services.py<br />
/usr/local/bin/smbclient.py<br />
/usr/local/bin/smbexec.py<br />
/usr/local/bin/smbrelayx.py<br />
/usr/local/bin/smbserver.py<br />
/usr/local/bin/sniff.py<br />
/usr/local/bin/sniffer.py<br />
/usr/local/bin/split.py<br />
/usr/local/bin/ticketer.py<br />
/usr/local/bin/wmiexec.py<br />
/usr/local/bin/wmipersist.py<br />
/usr/local/bin/wmiquery.py</code></td>
<td>Linux</td>
<td>Impacket post-exploitation framework scripts (not unique to DecisiveArchitect)</td>
</tr>
<tr>
<td><code>/usr/local/bin/ldapdomaindump<br />
/usr/local/bin/ldd2bloodhound</code></td>
<td>Linux</td>
<td>ldapdomaindump binaries used for Active Directory reconnaissance (not unique to DecisiveArchitect)</td>
</tr>
<tr>
<td><code>c:\users\use.bat<br />
c:\users\one.ps1</code></td>
<td>Windows</td>
<td>Unknown scripts</td>
</tr>
</tbody>
</table>
<h4><span style="font-weight: 400;">Additional Resources</span></h4>
<ul>
<li><em><span style="font-weight: 400;">Read about another threat that targets the telecommunications sector in this blog: </span><a href="https://www.crowdstrike.com/blog/an-analysis-of-lightbasin-telecommunications-attacks/"><span style="font-weight: 400;">LightBasin: A Roaming Threat to Telecommunications Companies</span></a><span style="font-weight: 400;">.</span></em></li>
<li><em><span style="font-weight: 400;">Download the </span><a href="https://www.crowdstrike.com/resources/reports/global-threat-report/"><span style="font-weight: 400;">CrowdStrike 2022 Global Threat Report</span></a><span style="font-weight: 400;"> for insights into adversaries tracked by CrowdStrike Intelligence in 2020.</span></em></li>
<li><em><a href="https://go.crowdstrike.com/try-falcon-prevent.html"><span style="font-weight: 400;">Get a full-featured free trial of CrowdStrike Falcon Prevent&#x2122; </span></a><span style="font-weight: 400;">and learn how true next-gen AV performs against today’s most sophisticated threats.</span></em></li>
</ul>
</div>
<style>
    .list-share-buttons{
        margin-bottom: 40px;
        margin-left: auto;
    }

    .share-button {
        float: left;
        color: #999;
        border: 1px solid #e4e4e4;
        text-align: center;
        transition: all 0.15s ease;
        margin-right: 5px;
        margin-bottom: 40px;
        margin-left: auto;
        font-size: 13px;
        padding: 0.5em 0.9em;
    }

    .tweet-btn{
        color: #999999;
    }
    .li-btn{
        color: #999999;
    }
    .tweet-btn:hover{
        color: #1DA1F2;
    }

    .li-btn:hover{
        color: #2867B2;
    }

    .fa{
        margin-right:5px;
    }

</style>
<div>
<ul class="list-share-buttons">

<li class="share-button">
<a class="tweet-btn " target="_blank" rel="noopener noreferrer" href="https://twitter.com/share?text=Hunting+a+Global+Telecommunications+Threat%3A+DecisiveArchitect+and+Its+Custom+Implant+JustForFun&amp;url=https://www.crowdstrike.com/blog/how-to-hunt-for-decisivearchitect-and-justforfun-implant/" onclick="if (!window.__cfRLUnblockHandlers) return false; window.open(this.href, '_blank', 'menubar=no,toolbar=no,resizable=yes,scrollbars=yes,height=600,width=600');" data-cf-modified-6f622b5d650afce2763d7d48-="">
<span class="fa-brands fa-twitter"></span>
<span>Tweet</span>
</a>
</li>

<li class="share-button">
<a class="li-btn" target="_blank" rel="noopener noreferrer" href="https://www.linkedin.com/shareArticle?mini=true&amp;url=https://www.crowdstrike.com/blog/how-to-hunt-for-decisivearchitect-and-justforfun-implant/&amp;title=Hunting+a+Global+Telecommunications+Threat%3A+DecisiveArchitect+and+Its+Custom+Implant+JustForFun" onclick="if (!window.__cfRLUnblockHandlers) return false; window.open(this.href, '_blank', 'menubar=no,toolbar=no,resizable=yes,scrollbars=yes,height=600,width=600');" data-cf-modified-6f622b5d650afce2763d7d48-="">
<span class="fa-brands fa-linkedin"></span>
<span>Share</span>
</a>
</li>
</ul>
</div>
<a href="https://go.crowdstrike.com/try-falcon-prevent.html">
<img class="post_cta" src="https://www.crowdstrike.com/wp-content/themes/main-theme/dist/images/blog/breaches-stop-here-post-cta.jpeg">
</a>
<h5>Related Content</h5>
<div class="row recent_articles">
<a class="col-12 col-md-4 recent_articles_item" href="/blog/falcon-overwatch-detects-iceapple-framework/">
<div class="post_image">
<img src="https://www.crowdstrike.com/wp-content/uploads/2022/05/0522_03_ICE-APPLE_R2_Blog_1060x698.jpeg" alt="">
</div>
<div class="post_info">
<h6>Proactive Threat Hunting Bears Fruit: Falcon OverWatch Detects Novel IceApple Post-Exploitation Framework</h6>
<div class="excerpt"></div>
</div>
</a>
<a class="col-12 col-md-4 recent_articles_item" href="/blog/compromised-docker-honeypots-used-for-pro-ukrainian-dos-attack/">
<div class="post_image">
<img src="https://www.crowdstrike.com/wp-content/uploads/2022/05/0522_01_CompromisedDocker_Pro-Ukrain_DoS-Attack_Blog_1060x698.jpeg" alt="">
</div>
<div class="post_info">
<h6>Compromised Docker Honeypots Used for Pro-Ukrainian DoS Attack</h6>
<div class="excerpt"></div>
</div>
</a>
<a class="col-12 col-md-4 recent_articles_item" href="/blog/navigating-five-stages-of-breach-grief/">
<div class="post_image">
<img src="https://www.crowdstrike.com/wp-content/uploads/2022/04/0422_01_5-Phases-Grief_Blog_1060x698.jpeg" alt="">
</div>
<div class="post_info">
<h6>Navigating the Five Stages of Grief During a Breach</h6>
<div class="excerpt"></div>
</div>
</a>
</div>
</div>
<div class="col-12 col-lg-4 sidebar">
<div class="blog_subsection">
<div class="blog_section_subtitle">
<div class="title">Categories</div>
</div>
</div>
<div class="blog_featured_category_list" id="blog_category_sidebar_item"></div>
<div class="social">
<h6>Connect with Us</h6>
<div class="social_icons">
<a href="https://www.twitter.com/CrowdStrike"><span class="fa-brands fa-twitter"></span></a>
<a href="https://www.facebook.com/CrowdStrike"><span class="fa-brands fa-facebook"></span></a>
<a href="https://www.linkedin.com/company/crowdstrike"><span class="fa-brands fa-linkedin"></span></a>
<a href="https://www.youtube.com/user/CrowdStrike"><span class="fa-brands fa-youtube"></span></a>
<a href="https://www.crowdstrike.com/blog/feed"><span class="fa fa-rss"></span></a>
</div>
</div>
<a class="free_trial_sidebar" href="https://www.crowdstrike.com/resources/reports/forrester-wave-endpoint-detection-and-response-2022/">
<img src="https://www.crowdstrike.com/wp-content/uploads/2021/07/Sidebar_EPP_ForresterWave_EDR.jpeg">
</a>
<div id="sideBarFeaturedArticles"></div>
<div class="subscribe_cta">
<h6>SUBSCRIBE</h6>
<p>Sign up now to receive the latest notifications and updates from CrowdStrike.</p>
<a class="button white-text white-outline white-text-hover dark-red-background-hover dark-red-outline-hover" data-behavior="modal" data-template-id="modal-42284" href="#">Sign Up</a>
</div>
<div class="demo_cta">
<img src="https://www.crowdstrike.com/wp-content/uploads/2021/07/red-falcon.svg">
<h6>See CrowdStrike Falcon in Action</h6>
<p>Detect, prevent, and respond to attacks— even malware-free intrusions—at any stage, with next-generation endpoint protection.</p>
<a class="button white-text red-background red-outline white-text-hover dark-red-background-hover dark-red-outline-hover" href="https://www.crowdstrike.com/see-demo/">See Demo</a>
</div>
</div>
</div>
<div class="post_nav row">
<div class="col-12">
<div class="links"><span class="fa fa-angle-double-left"></span> <a href="https://www.crowdstrike.com/blog/linux-mirai-malware-double-on-stronger-chips/" rel="prev">Mirai Malware Variants for Linux Double Down on Stronger Chips in Q1 2022</a></div>
<div class="links"></div>
</div>
</div>
</div>
</article>
<section id="freeTrialCta" class="blog-free-trial-cta">
<div class="container">
<div class="row">
<div class="col-12">
<div class="content">
<h1 class="free-trial-header">TRY CROWDSTRIKE FREE FOR 15 DAYS</h1>
<a class="button white-text red-background red-outline white-text-hover dark-red-background-hover dark-red-outline-hover" id="freeTrialOpenTrigger" href="#">GET STARTED WITH A FREE TRIAL</a>
</div>
</div>
</div>
</div>
<div id="freeTrialContent" class="free-trial-content-wrapper unstuck" style="display: none;">
<div class="container">
<p class="free-trial-close textright white"><a class="free-trial-close-trigger red" id="freeTrialCloseTrigger">X</a></p>
</div>
<div class="container free-trial-iframe-wrapper">
<iframe id="footer-form-frame" height="490" width="800" src="https://go.crowdstrike.com/WF-Trial-to-Pay_LP-Registration-Footer.html" class=""></iframe>
</div>
</div>
</section>
<script type="6f622b5d650afce2763d7d48-text/javascript">
    fetchInject([
        'https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/pages/blog.min.js?ts=1653472380000',
    ])
</script> </main>
<footer class="simple">
<div class="container">
<div class="row">
<div class="col-md-12 top">
<span class="footer-logo"><a class="red" href="https://www.crowdstrike.com"><i class="cs-icon-cs-logo"> </i></a></span>
<ul class="row social-links">
<li class="circle-icon-outline">
<a href="https://twitter.com/CrowdStrike" target="_blank"><i class="fa-brands fa-twitter"></i></a></li>
<li class="circle-icon-outline">
<a href="https://www.facebook.com/CrowdStrike/" target="_blank"><i class="fa-brands fa-facebook"></i></a>
</li>
<li class="circle-icon-outline">
<a href="https://www.linkedin.com/company/crowdstrike" target="_blank"><i class="fa-brands fa-linkedin"></i></a>
</li>
<li class="circle-icon-outline">
<a href="http://www.youtube.com/user/CrowdStrike" target="_blank"><i class="fa-brands fa-youtube"></i></a>
</li>
</ul>
</div>
<div class="col-md-12 bottom">
<ul class="row footer-lower-links">
<li class="footer-copyright">Copyright © 2022 CrowdStrike</li>
<li><a href="https://www.crowdstrike.com/privacy-notice/">Privacy</a></li>
<li><a href="https://www.crowdstrike.com/request-information/">Request Info</a></li>
<li><a href="https://www.crowdstrike.com/blog">Blog</a></li>
<li><a href="https://www.crowdstrike.com/contact-us/">Contact Us</a></li>
<li>1.888.512.8906</li>
</ul>
</div>
</div>
</div>
</footer>
</div>
</div>
</div>
<script type="6f622b5d650afce2763d7d48-text/javascript" async="async" src='https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/theme-scripts.min.js?ver=1653412578' id='theme-scripts-js'></script>
<script src="/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js" data-cf-settings="6f622b5d650afce2763d7d48-|49" defer=""></script></body>
</html>